CVE-2026-63237 describes a TOTP two-factor authentication bypass vulnerability in Koollab LMS version 5.3.2. The vulnerability arises because an attacker can supply a client-controlled seed to the TOTP generation process, allowing them to generate a valid one-time password that matches the expected value. This bypasses the second factor of authentication, potentially granting unauthorized access to administrator accounts. No official patch or remediation level has been provided as of the published date.

The vulnerability allows an attacker to bypass the second factor of authentication, reducing the security of administrator accounts to single-factor authentication. This can lead to unauthorized access with potential confidentiality and integrity impacts limited to the affected accounts. The CVSS score of 4.8 indicates a medium severity impact with low confidentiality and integrity impact and no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected version 5.3.2 of Koollab LMS and consider additional compensating controls such as enhanced monitoring or temporary disabling of two-factor authentication if feasible.